Collect only what the care requires.
A field nobody uses is a field that can leak. Intake forms start empty and every addition has to justify itself against a clinical need.
01Custody
Your health record should outlive the software that holds it.
We build [YOUR SERVICE] for [YOUR AUDIENCE]. Everything starts from one constraint — the person the data describes decides who reads it, for how long, and what happens when they leave.
Consent ledger — record [RECORD ID]
Visible to the patient, always
2026-09-01 09:14GRANTDr. [NAME] · cardiologyexpires in 30 days
2026-08-28 17:02EXPORTpatient · FHIR bundledownloaded once
2026-08-19 11:40REVOKE[FORMER CLINIC]access ended
2026-08-02 08:31READtriage nurse · [SITE]vitals only
Every read is written here before the data is returned. There is no path that skips it.
02Method
Three rules, applied before a single feature is designed.
Encrypt before it leaves the device.
Records are sealed client-side with a per-record key. What crosses the network, and what sits in our storage, is ciphertext.
Log every read, and show the log to the patient.
An audit trail only a vendor can read is a marketing claim. Ours is the same view the patient opens on their phone.
03Custody
Follow one record through its four states. Ask us the same questions your auditor will.
At rest
One record, one data key. The key is wrapped by a customer-scoped master key we cannot export.
- Mechanism
- AES-256-GCM envelope encryption, one data key per record
- Key holder
- [YOUR KMS] in [YOUR REGION] — separate account, separate credentials
- What we can see
- Ciphertext, record size, last-modified timestamp. Nothing else.
- Backups
- Encrypted with the same keys; restoring does not decrypt
In transit
Sealed before it leaves the client, and sealed again by the transport. Two independent layers.
- Mechanism
- TLS 1.3 only, HSTS preloaded, certificate pinning in our mobile clients
- Key holder
- Ephemeral session keys, forward secret, discarded on close
- What we can see
- Destination, byte count, timing. Not content.
- Third parties
- No analytics, no ad pixels, no CDN in front of record traffic
In use
The only moment plaintext exists. It lasts one request and is bounded by a grant the patient wrote.
- Mechanism
- Decrypted in memory for the life of a single request, in [YOUR REGION]
- Key holder
- A time-boxed patient grant — no grant, no key, no read
- What we can see
- Only the fields the grant names. Staff access needs a second grant.
- Written to
- The consent ledger, before the response is returned
After deletion
We destroy the key rather than chase every copy. The ciphertext stays, and stays unreadable.
- Mechanism
- Data key destroyed; remaining ciphertext is mathematically unrecoverable
- Key holder
- None. Not us, not your cloud provider, not a court order.
- What we can see
- A tombstone: a record existed and was deleted on [DATE]. No content.
- Timing
- Keys destroyed within [N] hours; backups age out within [N] days
Bracketed values are placeholders for your real infrastructure — nothing here is a claim until you sign it off. Full custody model.
04Programs
The same record, two ways in.
Intake and consent capture
One form that produces a signed, timestamped grant instead of a PDF in a shared drive.
LiveRecord portability
A FHIR export the patient triggers themselves, so transfers stop landing on your admin team.
LiveAudit review for [YOUR REGULATOR]
The ledger, filtered and exportable, in the shape your inspection actually asks for.
BetaSee who read your record
Every read, who made it, under which grant, and when that grant runs out.
LiveMove it somewhere else
Take a complete copy to another provider without asking anyone for permission.
LivePut an expiry on every grant
Access you gave a specialist last winter should not still be open this autumn.
LiveQuestions we get asked
Can your engineers read my record?
No. Support and engineering hold no data keys. A staff member who needs to see a record asks for a grant, the patient approves it with a scope and an expiry, and the request lands in the same ledger the patient reads.
What happens if Vellum Health shuts down?
Export is a right, not a retention feature. Records are exportable in FHIR at any time without contacting us, and the wind-down clause in the contract commits us to a [N]-day export window plus key destruction on a published schedule.
Where is the data, physically?
In [YOUR REGION], in [YOUR PROVIDER]. It does not move regions for scaling, analytics, or support convenience. Subprocessors are listed on the custody page and changes are announced [N] days ahead.
Who has audited this?
[YOUR AUDITOR] completed [AUDIT TYPE] in [MONTH YEAR]. The report and our penetration test summary go out under NDA on request — ask in the form below and we will send both.
05Access
Ask us the hard question first.
Send the question your compliance officer would send. We answer that one before we show you a demo.
Received.
We wrote your email to one row in one table. You will hear from [YOUR EMAIL] within [N] working days.